← back
CVE-2021-28310

Win32k Elevation of Privilege Vulnerability

CVSS 7.8 HIGHEPSS 8.3%● KEVCWE-787
Vexday Risk Score
71High priority
SSVC decision (CISA)
Act
Exploitation + impact → act immediately
CVSS 7.8EPSS 8.3%KEV simPoC públicaNuclei Metasploit Patch
Lifecycle
13 Apr 2021Published on NVD
14 Apr 2021Public PoC
03 Nov 2021Active exploitation (CISA KEV)
Recommendation: Patch as soon as possible — active exploitation confirmed.
In short

A flaw in Windows' graphical interface system (Win32k) allows an attacker with basic user access to gain administrator privileges on the computer. This is dangerous because it lets someone take complete control of the system.

Technical detail

CWE-787 (out-of-bounds write) in Win32k kernel component allows local privilege escalation when a user with standard privileges crafts malicious input that triggers a memory write beyond buffer boundaries, enabling execution with elevated system permissions.

Summary generated and translated by AI from the official description.
Win32k Elevation of Privilege Vulnerability
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →